Playstore v Aurora -- newby advice

hardtimes

Hi all,
No stranger to phones or custom ROMs but just got a 9a and need to get a Verizon app. The last time I needed a PlayStore app was on my old 4a and I used Aurora.

I find that on the 9a there is no Aurora. I just read through an exhausting thread here on Aurora v PlayStore and am a little confused. I have never had a google account and not keen to start.
If I create a PlayStore account to get the Verizon app I am not keen in handing over my phone number to google et al in order to create the account.

All other non-GOS apps on the phone are Open Source (compiled by me) or my own, I do not want to sully my app-sterility by sharing with google. :)

So, what's the real risk over using Aurora for a single app-download over giving google my phone number?
(side note) After many personal-data searches, I have never found the phone number for the 4a and that's from about 5-years back. I'd like to expand that record on the 9a.

de0u

hardtimes I find that on the 9a there is no Aurora.

I don't believe any release of GrapheneOS has ever included Aurora. But perhaps it had been manually installed on the 4a.

harp

hardtimes I am not keen in handing over my phone number to google et al in order to create the account.

AFAIK if you create a Google account directly in the Play Services or Store app on your phone, you may not be asked for a phone number. You just need to give an (anonymized) E-Mail address (or just use the offered Google Mail address).

Probably9857

harp hardtimes

Yes. Some additional tips if you want try this:

Immediately setup some form of 2FA, otherwise Google may later require you to add a phone number "to increase security".
I can't remember if using a VPN when you create the account might trigger a request for a phone number. Just in case, I would not use a VPN. (Go somewhere with public WiFi if you don't want to reveal your home IP address.)

Byteang3l

hardtimes the only downside of Aurora is that it doesn't do integrity checks, but that can be mitigated by doing them yourself either manually or with an app like app verifier. I think that's a small tradeoff for avoiding google entirely, but everyone has their own preference for that.

nologo

In my opinion, not wanting to create your own Google account for this one Play Store app is a perfectly valid reason to use Aurora.

hardtimes

nologo perfectly valid reason to use Aurora.

What are the risks of Aurora? The thread I read through here never clearly addressed specific issues relative to using the PlayStore. I'd rate handing over the phone number to G as an extreme issue. :)

hardtimes

de0u I don't believe any release of GrapheneOS has ever included Aurora.

I suspect you are correct, my mistake. I probably installed it through F-droid.

harp

Probably9857 Immediately setup some form of 2FA

Yes, that's highly recommended. Best Option would be setting up TOTP.

Probably9857 I can't remember if using a VPN when you create the account might trigger a request for a phone number.

Also a point I missed. In my experience, in some cases it's fine using a VPN or Orbot, sometimes it can end up in asking for a number. Avoid using it while setting up a Google account is the safest option to succeed without a phone number request.

hardtimes I'd rate handing over the phone number to G as an extreme issue.

As I wrote, creating the account within Play Services app there's no need to hand over a phone number. And sandboxed Google Play Services on GOS has no access to phone informations/identifiers like IMEI, phone number and so on.

de0u

hardtimes That seems most plausible.

hardtimes

Thanks all,

Just realized that I am actually in a ctach-22 thing. I need the Verizon app to get a phone number.

DeletedUser433

hardtimes There was a very comprehensive thread in this forum, I couldn't find it but it said something to the effect that Aurora is basically a middleman. You have to trust that whoever supplies the app has not tampered with it. That could work with AppVerifier. Also, from a security perspective, Aurora does not always deliver updates on time which can be a risk

I'm not sure how Verizon's app works but you could simply download it to another profile through aurora store, verify it with AppVerifier, get ur phone number and delete that profile. Apps can only build a profile of you within a system profile through IRC if GOS protections aren;t disabled

One of the workarounds to fix incompatible apps in GOS would disable a specific protection and allow them to identify the user(phone) across different profiles. I believe it was called 'Secure App Spawning'

harp

DeletedUser433 it said something to the effect that Aurora is basically a middleman

Some people (incl. GOS devs) also criticize the use of 'anonymized' (that means shared) accounts for privacy reasons. (If you prefer using them instead of an own (throwaway) Google account.)

hardtimes

Thanks again,
What about sites like apkmirror etc. I kinda trust.them?

DeletedUser433

hardtimes apk mirror is pretty straightforward, downloading the apk and checking with AppVerifier is enough. But of course, you won't get updates

hardtimes

DeletedUser433 But of course, you won't get updates

OK, thanks, might do that.

harp

Byteang3l I think that's a small tradeoff for avoiding google entirely

It's not really 'entirely', it's still Google Play Store where you're downloading from.

Byteang3l

harp without the requirements for play store and play services or a Google account of any kind.

nandohyphen1

hardtimes I use Aurora

harp

Byteang3l without the requirements for play store and play services or a Google account of any kind.

Yes, that's (almost) correct:

You're still using a Google account. Not necessarily an own (anonymized or personalized) but alternatively a shared Google account provided by Aurora Store. That's how the 'anonymized' access to Aurora works, using a Google account, that is used by many others (hundreds, thousands?) too. And you 'share' also some information of your device, that account is able to detect, which (via Aurora installed) apps are on your device as well as some device specific information like at least the specific phone model and some Info about the used OS. (but no hardware identifiers like IMEI, etc.)

That might be still an advantage against using an own account for some people but you should keep that in mind.

So the statement

Byteang3l without the requirements for ... a Google account of any kind

is wrong. You always have to use a Google account "of any kind", even if it's a shared one. Aurora cannot avoid the requirement of an account for downloading apps from Play Store, that's impossible.

Byteang3l

harp I was implying that it was without the requirement of an owned account given the context, but I'm not going to get into a debate of semantics with you since that's clearly what you're going for.